Published on Your Electronics Open Source (http://dev.emcelettronica.

com)

Home > My blog > Contenuti

Accelerated Antivirus Solution Platform from

Freescale & Kaspersky
By Ionela
Created Apr 7 2009 - 07:40

Accelerated AV (Accelerated Antivirus) is a high-performance network antivirus solution platform offered

by Freescale Semiconductor and Kaspersky Lab to OEM vendors. Accelerated Antivirus is based on
Freescale's MPC8572E PowerQUICC III processor [1] built on Power Architecture technology and
Kaspersky's SafeStream signatures database.

[If you want to know more about this Freescale product, please submit your request to Arrow Italy using
this form [2] (this form is valid ONLY for Companies or Customers based in Italy and working in the Italian
area)]

The platform enables the rapid development of competitive, high-performance, cost-effective network AV
devices that are highly effective in the mitigation of the impact of dangerous and widespread malware
(viruses, worms and trojans) and malware outbreaks.

Network Antivirus Landscape and Trends

The damage caused by computer malware is very significant. Today, most computers in enterprises are
protected by antivirus software to minimize the damage potentially caused by malicious programs. The
graph illustrates the speed of infection of major malware outbreaks in recent years.
Unfortunately, it may take days, if not weeks, to apply software patches and malware signature updates to
all PCs and servers in a large enterprise to defend against a new malware. A network-based solution is
inherently more effective than a host-based solution to control malware propagation?applying updates to
the much fewer number of network AV devices takes less time (and consumes less network bandwidth). A
suitably positioned network-based AV device stops malware before it gets to the host computers. Most
enterprises are therefore using network-based AV solutions to mitigate the impact of malware outbreaks to
complement a host-based AV solution for in-depth defense.

Traditional network AV is proxy based. In a typical deployment scenario, the mail relay receives the
complete e-mail, invokes the antivirus function and forwards the e-mail on to the mail server if it is checked
out to be clean. This is a store-and-forward operation. Real time is not a primary concern. Only e-mail
traffic?a fraction of the total traffic going into or out of the enterprise network?goes through the mail relay. If
there is a delay of a few seconds or even a few minutes, the end-user does not notice.

Traditional Network AV Deployment

Design Challenges
OEM vendors are faced with a number of design challenges in order to develop and support an effective
product to win in the network-based antivirus marketplace. These include:

? Cost effectiveness
? High performance
? Guaranteed, continual, timely availability of accurate malware signatures coupled with fast, in-
service, incremental updates of signatures
? High accuracy

To compete successfully in the market, the network AV device has to be cost effective. A device built from
several discrete processors and hardware components may achieve the performance and accuracy
required, but the bill of materials and development costs will likely become too high for the marketplace.

Accelerated AV Solution Platform

The solution platform consists of components from Freescale and Kaspersky.

Freescale Components

? MPC8572E PowerQUICC III processor [3] with integrated pattern matcher

? Associated software
? Associated documentation

Software includes drivers and board support packages that are typical of Freescale processors. In addition,
specific to the MPC8572E and other future processors with a built-in Pattern Matcher, it also includes
Pattern Matcher-specific software for Linux:

? Pattern management software:

o RegEx compiler
o Stateful rule compiler
o Linker loader
o Sample Pattern Matcher management application

? Pattern Matcher driver

? Sample Pattern Matcher data scan application

With these, the OEM will be able to develop its product hardware and software.

Kaspersky Components
The solution platform components available through Kaspersky are:

? Kaspersky SafeStream signatures database in binary Freescale Pattern Matcher format

? Regular daily updates and urgent (in case of malware outbreaks) updates of Kaspersky
SafeStream
signatures database, also in binary Freescale Pattern Matcher format

In other words, before delivery to the OEM, native Kaspersky SafeStream signatures are:

? Pre-converted to Freescale format

? Pre-compiled to Freescale binary format
? Verified to work with Freescale's Pattern Matcher

OEM Responsibility
It is the responsibility of the OEM to develop the following:

? Proprietary system hardware powered by the MPC8572E PowerQUICC III

? Proprietary management and scanning software utilizing the Pattern Matcher
? Mechanism to deliver the signatures in Freescale binary format to its customers, who will link and
load the signatures into the network AV device. It is the OEM's choice whether to incorporate the
linking and loading of signatures into its security policy management framework.

The OEM may choose to use products and services from other ODMs to develop the complete solution.

Designing Network-Based AV with the Accelerated AV Platform

In order to understand what an ideal network AV platform looks like, let's examine the key operations
performed in a typical network AV device. Note that while SMTP is used in the example, other application
protocols carrying the file/object to be inspected are also applicable. The Accelerated AV solution is
independent of the application protocol.

The key data path operations in a typical network AV device are as follows:

? Allow traffic not of interest to flow through transparently

? Reassemble (with or without transparent TCP termination) traffic of interest?SMTP is used in the
above diagram, but other traffic such as HTTP and FTP are also applicable
? Observe end-to-end SMTP protocol exchange and capture e-mails on the fly
? MIME decode, separate e-mail into component parts, e. g. attachments
? Additional unpacking/decompression (for example, unzipping) processing of message

Read the Italian version: Piattaforma Accelerated Antivirus da Freescale & Kaspersky [4]

CONTACT REQUEST
If you want to know more about this Freescale product, please submit your request to Arrow Italy using
this form [2].

NOTE: this form is valid ONLY for Companies or Customers based in Italy and working in the Italian area.

Technology antivirus solution

Trademarks

Source URL: http://dev.emcelettronica.com/accelerated-antivirus-solution-platform-freescale-kaspersky

Links:
[1] http://www.freescale.com/webapp/sps/site/overview.jsp?code=DRPQMPC8572RSC&fsrch=1
[2] http://it.emcelettronica.com/contact/freescale
[3] http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=MPC8572E&fsrch=1
[4] http://it.emcelettronica.com/piattaforma-accelerated-antivirus-da-freescale-kaspersky